Honeycyber: Automated signature generation for zero-day polymorphic worms

Author(s)
Author(s)
Mohammed, M. M. Z. E.
Ventura, N.
Date Issued
2008
Publisher
IEEE
Related Publication(s)
Proceedings of the 2008 IEEE Military Communications Conference (MILCOM)
Start page
980
End page
985
Abstract
Signature-based intrusion detection systems (IDSs) can be evaded by polymorphic worms which vary their payloads in every infection attempt. In this paper, we propose Honeycyber, a system for automated signature generation for zero-day polymorphic worms. We have designed a novel double-Honeynet system, which is able to automatically detect new worms and isolate the attack traffic from innocuous traffic. We introduce unlimited Honeynet outbound connections, which allow us to capture different payloads in every infection of the same worm. The system is able to generate signatures to match most polymorphic worm instances with low false positives and low false negatives.
URI
DOI
SFU Affiliated Publication
No
Availability at SFU Library

No database links found.